MCP-04: add MCP transaction v1 parser and fee hooks

audit.md

@@ -0,0 +1,60 @@
+# MCP Audit — Post-Fix Verification (Master)
+
+Date: 2026-02-12
+Branch: `master`
+Scope: Re-validated latest `audit.md` concerns against code, implemented minimal-diff fixes on `master`, and re-ran targeted + e2e tests.
+
+## Executive Summary
+
+- Prior high and medium findings from the latest audit pass are now closed in code.
+- MCP integration remains end-to-end passing in 5-node local cluster.
+- Two non-blocking items remain tracked:
+  - hash-only equivocation conflict marker (`McpConflictMarker`)
+  - O(n) nonce-less outstanding-request match path for MCP repair responses
+
+## Concern Status
+
+| ID | Concern | Status | Evidence |
+|---|---|---|---|
+| H1 | Vote-gate signature/equivocation checks dead due to pre-filtering | FIXED | `core/src/mcp_replay.rs:181` builds `VoteGateInput` from raw aggregate entries; relay/proposer signatures verified at `core/src/mcp_replay.rs:189` and `core/src/mcp_replay.rs:200`. |
+| H2 | Replay bridge parsed bincode before MCP, losing MCP fee components | FIXED | MCP parse now first at `ledger/src/blockstore_processor.rs:1778`, bincode fallback second at `ledger/src/blockstore_processor.rs:1789`. |
+| M1 | Dispatch `any()` short-circuit skipped remaining proposer indices | FIXED | `turbine/src/broadcast_stage/standard_broadcast_run.rs:872` iterates all proposer indices without early return; targeted-proposer path no longer aborts batch at `turbine/src/broadcast_stage/standard_broadcast_run.rs:861`. |
+| M2 | Silent reconstruction tx drops | FIXED | Drops now counted with typed cause counters at `core/src/mcp_replay.rs:524`, `core/src/mcp_replay.rs:529`; aggregate drop counter at `core/src/mcp_replay.rs:519`. |
+| M3 | Missing nonce fee edge coverage | DISMISSED (already covered) | Existing tests in `runtime/src/bank/tests.rs:1491` and `runtime/src/bank/tests.rs:1535`. |
+| M4 | Weak equivocation evidence (hash-only marker) | OPEN (non-blocking v1 tradeoff) | `ledger/src/blockstore.rs:233` intentionally stores deterministic hashes only in `McpConflictMarker`. |
+| N1 | MCP repair only requested first missing shred per proposer per scan | FIXED | `core/src/repair/repair_service.rs:706` continues scanning and enqueues multiple missing shreds up to budget. |
+| N2 | `tx_count` capacity allocation from untrusted data could OOM | FIXED | Bound check added before allocation at `ledger/src/blockstore_processor.rs:1711`; reject impossible tx_count. |
+| N3 | Typed reconstruction metadata error variant discarded | FIXED | Per-variant counters added at `core/src/mcp_replay.rs:524` and `core/src/mcp_replay.rs:529`. |
+| N4 | No MCP feature gate on repair serve-side `McpWindowIndex` | FIXED | Serve-side gate added at `core/src/repair/serve_repair.rs:689`; pre-feature requests dropped and counted at `core/src/repair/serve_repair.rs:710`. |
+| N6 | No counter for per-proposer duplicate signature drops during reconstruction | FIXED | Counter added at `core/src/mcp_replay.rs:540`. |
+| N7 | MCP consensus retention slot constant duplicated in two files | FIXED | Unified via `ledger/src/mcp.rs` (`CONSENSUS_BLOCK_RETENTION_SLOTS`) and consumed in `core/src/mcp_replay.rs:318` and `core/src/window_service.rs:325`. |
+
+## New/Updated Tests
+
+- `core/src/repair/serve_repair.rs`:
+  - `test_handle_repair_mcp_window_request_requires_feature_activation`
+- `ledger/src/blockstore_processor.rs`:
+  - `test_decode_mcp_execution_output_wire_transactions_rejects_unbounded_tx_count`
+- `core/src/repair/repair_service.rs` tests updated to validate multi-shred enqueue behavior.
+
+## Validation Runs
+
+All commands succeeded.
+
+- `cargo test -p solana-core test_identify_mcp_repairs_enqueues_missing_shreds -- --nocapture`
+- `cargo test -p solana-core test_identify_mcp_repairs_skips_slot_with_final_execution_output -- --nocapture`
+- `cargo test -p solana-core test_handle_repair_mcp_window_request_requires_feature_activation -- --nocapture`
+- `cargo test -p solana-ledger test_decode_mcp_execution_output_wire_transactions_roundtrip -- --nocapture`
+- `cargo test -p solana-ledger test_decode_mcp_execution_output_wire_transactions_rejects_unbounded_tx_count -- --nocapture`
+- `cargo test -p solana-core mcp_replay -- --nocapture`
+- `cargo test -p solana-core mcp_vote_gate -- --nocapture`
+- `cargo test -p solana-turbine test_maybe_dispatch_mcp_shreds_removes_complete_slot_payload_state -- --nocapture`
+- `cargo check -p solana-core -p solana-ledger -p solana-turbine`
+- `cargo test -p solana-local-cluster test_local_cluster_mcp_produces_blockstore_artifacts -- --nocapture`
+  - PASS, 5-node run, finished in 59.49s.
+
+## Current Verdict
+
+- Critical blockers: **0 open**.
+- Medium blockers: **0 open**.
+- Remaining tracked non-blocking items: **2** (`McpConflictMarker` hash-only evidence, O(n) nonce-less outstanding request scan).

compute-budget-instruction/src/compute_budget_instruction_details.rs

@@ -152,6 +152,13 @@ impl ComputeBudgetInstructionDetails {
         })
     }
 
+    pub fn requested_compute_unit_price(&self) -> u64 {
+        self.requested_compute_unit_price
+            .map_or(0, |(_, requested_compute_unit_price)| {
+                requested_compute_unit_price
+            })
+    }
+
     fn process_instruction(&mut self, index: u8, instruction: &SVMInstruction) -> Result<()> {
         let invalid_instruction_data_error =
             TransactionError::InstructionError(index, InstructionError::InvalidInstructionData);

core/src/banking_stage/consumer.rs

@@ -7,34 +7,79 @@ use {
     },
     crossbeam_channel::unbounded,
     itertools::Itertools,
-    solana_clock::MAX_PROCESSING_AGE,
-    solana_fee::FeeFeatures,
+    solana_account::ReadableAccount,
+    solana_clock::{Slot, MAX_PROCESSING_AGE},
+    solana_fee::{FeeFeatures, MCP_NUM_PROPOSERS},
     solana_fee_structure::FeeBudgetLimits,
     solana_measure::measure_us,
+    solana_nonce_account::{get_system_account_kind, SystemAccountKind},
     solana_poh::{
         poh_recorder::PohRecorderError,
         transaction_recorder::{
             RecordTransactionsSummary, RecordTransactionsTimings, TransactionRecorder,
         },
     },
+    solana_pubkey::Pubkey,
     solana_runtime::{
         bank::{Bank, LoadAndExecuteTransactionsOutput},
         transaction_batch::TransactionBatch,
     },
-    solana_runtime_transaction::transaction_with_meta::TransactionWithMeta,
+    solana_runtime_transaction::{
+        transaction_meta::StaticMeta, transaction_with_meta::TransactionWithMeta,
+    },
     solana_svm::{
-        account_loader::validate_fee_payer,
+        account_loader::{validate_fee_payer, validate_fee_payer_for_mcp},
         transaction_error_metrics::TransactionErrorMetrics,
         transaction_processing_result::TransactionProcessingResultExtensions,
         transaction_processor::{ExecutionRecordingConfig, TransactionProcessingConfig},
     },
     solana_transaction_error::TransactionError,
-    std::{num::Saturating, sync::Arc},
+    std::{collections::HashMap, num::Saturating, sync::Arc},
 };
 
 /// Consumer will create chunks of transactions from buffer with up to this size.
 pub const TARGET_NUM_TRANSACTIONS_PER_BATCH: usize = 64;
 
+#[derive(Default)]
+pub struct McpFeePayerTracker {
+    current_slot: Option<Slot>,
+    reserved_lamports_by_payer: HashMap<Pubkey, u64>,
+}
+
+impl McpFeePayerTracker {
+    pub fn try_reserve(
+        &mut self,
+        slot: Slot,
+        payer: Pubkey,
+        payer_lamports: u64,
+        nonce_min_balance: u64,
+        additional_fee: u64,
+    ) -> Result<(), TransactionError> {
+        if self.current_slot != Some(slot) {
+            self.current_slot = Some(slot);
+            self.reserved_lamports_by_payer.clear();
+        }
+
+        let available = payer_lamports
+            .checked_sub(nonce_min_balance)
+            .ok_or(TransactionError::InsufficientFundsForFee)?;
+        let currently_reserved = self
+            .reserved_lamports_by_payer
+            .get(&payer)
+            .copied()
+            .unwrap_or_default();
+        let next_reserved = currently_reserved
+            .checked_add(additional_fee)
+            .ok_or(TransactionError::InsufficientFundsForFee)?;
+        if next_reserved > available {
+            return Err(TransactionError::InsufficientFundsForFee);
+        }
+
+        self.reserved_lamports_by_payer.insert(payer, next_reserved);
+        Ok(())
+    }
+}
+
 pub struct ProcessTransactionBatchOutput {
     // The number of transactions filtered out by the cost model
     pub(crate) cost_model_throttled_transactions_count: u64,
@@ -312,6 +357,7 @@ impl Consumer {
                     recording_config: ExecutionRecordingConfig::new_single_setting(
                         transaction_status_sender_enabled
                     ),
+                    skip_fee_collection: false,
                 }
             ));
         execute_and_commit_timings.load_execute_us = load_execute_us;
@@ -491,6 +537,85 @@ impl Consumer {
             fee,
         )
     }
+
+    pub fn check_fee_payer_unlocked_mcp(
+        bank: &Bank,
+        transaction: &impl TransactionWithMeta,
+        fee_tracker: &mut McpFeePayerTracker,
+        error_counters: &mut TransactionErrorMetrics,
+    ) -> Result<(), TransactionError> {
+        let fee_payer = transaction.fee_payer();
+        let fee_budget_limits = FeeBudgetLimits::from(
+            transaction
+                .compute_budget_instruction_details()
+                .sanitize_and_convert_to_compute_budget_limits(&bank.feature_set)?,
+        );
+        let base_fee = solana_fee::calculate_fee(
+            transaction,
+            bank.get_lamports_per_signature() == 0,
+            bank.fee_structure().lamports_per_signature,
+            fee_budget_limits.prioritization_fee,
+            FeeFeatures::from(bank.feature_set.as_ref()),
+        );
+        let mcp_fee_components = transaction.mcp_fee_components().unwrap_or_default();
+        let effective_fee = base_fee
+            .checked_add(mcp_fee_components.0)
+            .and_then(|fee| fee.checked_add(mcp_fee_components.1))
+            .ok_or(TransactionError::InsufficientFundsForFee)?;
+
+        let (mut fee_payer_account, _slot) = bank
+            .rc
+            .accounts
+            .accounts_db
+            .load_with_fixed_root(&bank.ancestors, fee_payer)
+            .ok_or(TransactionError::AccountNotFound)?;
+
+        let nonce_min_balance = match get_system_account_kind(&fee_payer_account)
+            .ok_or(TransactionError::InvalidAccountForFee)?
+        {
+            SystemAccountKind::System => 0,
+            SystemAccountKind::Nonce => bank
+                .rent_collector()
+                .rent
+                .minimum_balance(solana_nonce::state::State::size()),
+        };
+        let scaled_fee = effective_fee
+            .checked_mul(MCP_NUM_PROPOSERS as u64)
+            .ok_or(TransactionError::InsufficientFundsForFee)?;
+        fee_tracker.try_reserve(
+            bank.slot(),
+            *fee_payer,
+            fee_payer_account.lamports(),
+            nonce_min_balance,
+            scaled_fee,
+        )?;
+
+        validate_fee_payer_for_mcp(
+            fee_payer,
+            &mut fee_payer_account,
+            0,
+            error_counters,
+            &bank.rent_collector().rent,
+            effective_fee,
+        )
+    }
+
+    pub fn check_fee_payer_unlocked_admission(
+        bank: &Bank,
+        transaction: &(impl TransactionWithMeta + StaticMeta),
+        fee_tracker: &mut McpFeePayerTracker,
+        error_counters: &mut TransactionErrorMetrics,
+    ) -> Result<(), TransactionError> {
+        let mcp_feature_active = bank
+            .feature_set
+            .activated_slot(&agave_feature_set::mcp_protocol_v1::id())
+            .is_some_and(|activated_slot| bank.slot() >= activated_slot);
+        if mcp_feature_active && transaction.mcp_fee_components().is_some() {
+            Self::check_fee_payer_unlocked_mcp(bank, transaction, fee_tracker, error_counters)
+        } else {
+            Self::check_fee_payer_unlocked(bank, transaction, error_counters)
+        }
+    }
 }
 
 #[cfg(test)]
@@ -568,6 +693,27 @@ mod tests {
         consumer.process_and_record_transactions(&bank, &transactions)
     }
 
+    #[test]
+    fn test_mcp_fee_payer_tracker_prevents_overcommit() {
+        let payer = Pubkey::new_unique();
+        let mut tracker = McpFeePayerTracker::default();
+
+        assert_eq!(tracker.try_reserve(10, payer, 1_000, 0, 600), Ok(()));
+        assert_eq!(
+            tracker.try_reserve(10, payer, 1_000, 0, 401),
+            Err(TransactionError::InsufficientFundsForFee)
+        );
+
+        // Slot change resets cumulative reservations.
+        assert_eq!(tracker.try_reserve(11, payer, 1_000, 0, 900), Ok(()));
+
+        // Nonce minimum balance is reserved.
+        assert_eq!(
+            tracker.try_reserve(11, payer, 1_000, 200, 801),
+            Err(TransactionError::InsufficientFundsForFee)
+        );
+    }
+
     fn generate_new_address_lookup_table(
         authority: Option<Pubkey>,
         num_addresses: usize,